# AI-Driven Fast and Early Detection of IoT Botnet Threats: A Comprehensive Network Traffic Analysis Approach

arXiv: https://arxiv.org/abs/2407.15688 · HTML: https://mlsanity.com/paper/2407.15688/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 0 of its 15 references that are in the map.
- First posted on arXiv 22 Jul 2024.

## Built on by (most cited first, 3 of 3)

- [BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction](https://mlsanity.com/paper/2501.01664/) (2025)
- [Zero-Day Botnet Attack Detection in IoV: A Modular Approach Using Isolation Forests and Particle Swarm Optimization](https://mlsanity.com/paper/2504.18814/) (2025)
- [Fuse and Federate: Enhancing EV Charging Station Security with Multimodal Fusion and Federated Learning](https://mlsanity.com/paper/2506.06730/) (2025)

## Abstract (arXiv)

In the rapidly evolving landscape of cyber threats targeting the Internet of Things (IoT) ecosystem, and in light of the surge in botnet-driven Distributed Denial of Service (DDoS) and brute force attacks, this study focuses on the early detection of IoT bots. It specifically addresses the detection of stealth bot communication that precedes and orchestrates attacks. This study proposes a comprehensive methodology for analyzing IoT network traffic, including considerations for both unidirectional and bidirectional flow, as well as packet formats. It explores a wide spectrum of network features critical for representing network traffic and characterizing benign IoT traffic patterns effectively. Moreover, it delves into the modeling of traffic using various semi-supervised learning techniques. Through extensive experimentation with the IoT-23 dataset - a comprehensive collection featuring diverse botnet types and traffic scenarios - we have demonstrated the feasibility of detecting botnet traffic corresponding to different operations and types of bots, specifically focusing on stealth command and control (C2) communications. The results obtained have demonstrated the feasibility of identifying C2 communication with a 100% success rate through packet-based methods and 94% via flow based approaches, with a false positive rate of 1.53%.